About abi2023

abi2023 · ‎04-29-2024

In my index I don't see all the logs being forwarder by the Splunk UF. How can monitor when event is drop from event queue on the Spunk UF. Can I monitor this in Splunk Deployment server?

abi2023 · ‎03-29-2024

Can I do this buy source? and does source can take different props conf.

abi2023 · ‎03-27-2024

Is it possible in Splunk to have one props.conf file on one server's Universal Forwarder (UF) for a specific app, and another props.conf file on a different server for the same app, but with one file masking a certain field and the other not?

abi2023 · ‎03-26-2024

I want mask some data coming from web server logs particularly only one server out of all my web server logs. Can I apply my masking rule to only one my webserver source instead of all my web server sending to the same sourcetype? If I apply this rule to all web server log it will be high resource usage at my indexer? Thanks

abi2023 · ‎03-21-2024

Can this work for passing value to Splunk add on for Servicenow. Description section. Thank you

abi2023 · ‎03-19-2024

I want my send email action email body to be in table view as my search result. How do I pass dynamic token field value. $result.name$ $result.index$$result.sourcetype$ how do I make field value come side by side instead of below. how I am getting now in my email body name name2 name3 name4 index index2 index3 index4 sourcetype sourcetype2 sourcetype3 sourcetype4 I want to be like below. name index sourcetype name2 index2 sourcetype2 name3 index3 sourcetype3 name4 index4 sourcetype4 Is it possible to do

abi2023 · ‎03-06-2024

I am able to solve this by add ' before and after $result.fieldname$ example '$result.fieldname$'

abi2023 · ‎03-06-2024

I want to pass dynamic value from my search result into email alert subject. I try $result.fieldname$ but it not coming up in the email alert can someone help me? Thanks

abi2023 · ‎02-26-2024

my following regex is matching "RDPword=jsndksjs834u935=PDUserId=jsndksjs834u935=PDPword=jsndksjs834u935" I want to exclude follwing "=PDUserId=jsndksjs834u935=" how do I modify the this rex to not match =PDUserId=jsndksjs834u935= RDPword=([^=]+)=PDUserId=([^=]+)=PDPword=([^=]+) RDPword=([^=]+)=PDUserId=([^=]+)=PDPword=([^=]+)

abi2023 · ‎02-26-2024

I need to mask data before it being index. my sample his log structure. "2023-11-02 06:53:00 xx.xxx.xxx.xx GET /Security/Security/Logon 123 - xx.xxx.x.xxx Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.198+Safari/537.36=RDPword=jsndksjs834u935=PDUserId=jsndksjs834u935=PDPword=jsndksjs834u935=RFuser=&securityToken=xxxxxxxx 200 0 0 14" I need to match highlights in green "RDPword=jsndksjs834u935", and "PDPword=jsndksjs834u935" I am using regex this matching the following which I don't want it match "PDUserId=jsndksjs834u935=" RDPWord=([^=]+)=PDUUserId=([^=]+)=PDPWord=([^=]+) Can someone help me Thanks

abi2023 · ‎01-23-2024

I upgrade Splunk enterprise to 9.1.2 after doing the upgrde I see high CPU utization. Is anyone encounter simmilar issue after upgrading. Splunk running on window server.

abi2023 · ‎12-20-2023

is It possible to do in Splunk. and What type of logs I need to have in Splunk?

abi2023 · ‎12-04-2023

I am getting error messages WARNING: web interface does not seem to be available! I just install the Splunk on my Mac.

abi2023 · ‎10-23-2023

Below is my CSV In this table when fist identify the Flow in our app we will update csv file with _key, App_name Date_find , Risk, and Status. when update happen the I will upload or ingest the csv file into Splunk. almost real time. this csv we are keeping it as lookup outside Splunk. So nothing get deleted. when I ingest or upload all the pervious entry get ingest in Splunk. only different is timestamp time at the ingestion. so all the entry such as _key 1 ,2, so get same timestamp. I want to know if it possible to return the latest result only. so I will have all the data and not any duplicate. otherwise I need to find the different solution. Same thing happen when flow get fix Remediate_date, Risk_Afterremediate, and status get updated. file get ingested into Splunk. Thank you in advance. _key App_name Date_find Status Risk Remediate_date Risk_After remediate Status 1 App1 12/04/2022 Open Critical 12/10/2022 Sustainable Closed 2 App2 01/26/2023 Open Moderate 02/12/2023 Sustainable Close

abi2023 · ‎10-20-2023

I am uploading csv file format data into splunk. every time I make change to the data or add any info I will update the full csv file into splunk. now I have duplicate event in splunk. Is it possible to sort by only last upload csv file data show? Thanks

abi2023 · ‎10-16-2023

I have SPL index=main state=open | stats count(state) as open by risk_rating | rename risk_rating as state | addtotals col=t row=f labelfield=state | append [ search index=main state=closed | stats count(state) as closed by risk_rating_after | rename risk_rating_after as state | addtotals col=t row=f labelfield=risk I want crate table like below but risk_rating_after field only has Sustainable value so when I do selfjoin state it only has sustainable. I try join but it did not get result. It any way I can achieve this result. Many thank you in advance. state Critical Moderate Severe Sustainable Total Open 1 2 4 5 12 Close 0 0 0 6 6 Total 1 2 4 11 18

abi2023 · ‎09-15-2023

in my search I have no lookup command. Anyone knows why I am getting this error.

abi2023 · ‎09-15-2023

I try change permission to all app option but I don't see the option. I s anyother way make my macro available for all apps.

abi2023 · ‎08-31-2023

index=main sourcetype=_json status="True" | stats count(status) as True by name | append [| search index=main sourcetype=json status="False" | stats count(status) as False by name] | append [| search index=main sourcetype=json status="*" | stats count(status) as Total by name] | stats sum(True) as True sum(False) as False sum(Total) as Total max(Performance) as Performance by name | eval Percentage=round(((True/Total)*100),0) | fields Percentage Is it possible to show trendline and if Percentage up or down compart to last month.

abi2023 · ‎08-30-2023

How do I change color single value trend by default it either red for negative, and green for positive. I want my single value color to be as I define in my range value even if trend is negative or positive. below is my source code. <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0xff1414","0xdc4e41","0x53a051","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[20,30,50,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">-30d</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> Thank you in advance.

abi2023 · ‎08-25-2023

|inputlookup demo.csv | eval ip = "xx.xxx.xxx.xxx" ```Enter IP address you the Match``` | eval result=if(cidrmatch(ip_range, ip), "true", "false") | search result="true" i am using above spl to return result for the ip address associated with the IP range in lookup table. this work fine. I want do same thing when index=main has field ip which contains IP address. I need to invoke cidrmatch out result assiate with same iprange. how do modifiy my SPL. SINCE lookup table and my index info has nothing in common other than Ip field i have and lookup table has ip tange info. Is there way i can use lookup cammand do this? Thanks

abi2023 · ‎08-23-2023

I uploaded csv lookup table has 2 field location and iprange. iS THERE WAY TO GET WHAT ARE POSSIBLE IP IN EACH RANGE. SO I CAN ENTER IP address it will return the location for that range?

abi2023 · ‎08-23-2023

| timechart span=1mon count by status | addtotals row=t col=f labelfield=Total True False "Not available" fieldname="Total_Count" | eval percent=round(((True/Total_Count)*100),0) | table Date Percentage I chose visualization column chart but I get only default color. How can I customize the color base on the range. 0- 50% RED 50-70 AS YELLOW 70-100 AS Green. <option name="charting.fieldColors">{"<50":"#e600ac","Up to 60":"#ff0000","Up to 80":"#ffa31a","Up to 100":"#33cc33"}</option> I try modifying but it did not work. Can anion help Thanks

abi2023 · ‎08-15-2023

I have two lookup table call name.csv and id.csv. both has matching field call fullname. id.csv file has id field but name.csv doesnot. but I want to add id field to name.csv. Is anyone know how to add id field name.csv file. I try | inputlookup name.csv | lookup id.csv fullname output id but it didnot work.

abi2023 · ‎08-14-2023

I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname. I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv? | inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname] but this SPL displaying result found in the both look table. Is any way to do this in splunk? ADDVANCE Thanks

Posts	49
Solutions	3
Karma Given	13
Karma Received	3
Member Since	‎04-20-2023

Online Status	Offline
Date Last Visited	‎04-30-2024 04:54 PM

How do I verify if splunk forwarder dropping event...

does Splunk UF has capability to mask data as it s...

Can I apply masking at host level instead of sourc...

Passing result.<fieldname> token

how do I pass search result value into email subje...

help with regex for masking?

I have high CPU utilization and memory usage after...

I want to validate patch work done on windows side...

Splunk wont open localhost:8000

How to get latest upload data.I am uploading csv f...

How do I verify if splunk forwarder dropping event...

Re: does Splunk UF has capability to mask data as ...

does Splunk UF has capability to mask data as it s...

Can I apply masking at host level instead of sourc...

Re: Passing result.<fieldname> token

Passing result.<fieldname> token

Re: how do I pass search result value into email s...

how do I pass search result value into email subje...

Re: help with regex for masking?

help with regex for masking?

I have high CPU utilization and memory usage after...

I want to validate patch work done on windows side...

Splunk wont open localhost:8000

Re: How to get latest upload data.I am uploading c...

How to get latest upload data.I am uploading csv f...

I want create table view

I am getting "Could not load lookup=LOOKUP-pulse_c...

how do I make my macro available all app

Is it possible to have Single value with Trendline...

Re: How to color trend in single value?

Re: getting ip range lookup

How to get ip range lookup?

how to change color for column chart

LOOKUP table: How to add id field name.csv file?

How to compare two matching field from two look up...